matrix_test.go

package matrix

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"scripts/camunda-core/pkg/versionmatrix"
	"gopkg.in/yaml.v3"

	"scripts/camunda-deployer/pkg/deployer"
	"scripts/deploy-camunda/config"
	"scripts/deploy-camunda/deploy"
)

// --- Version comparison tests ---

func TestParseVersion(t *testing.T) {
	tests := []struct {
		input     string
		wantMajor int
		wantMinor int
	}{
		{"8.6", 8, 6},
		{"8.9", 8, 9},
		{"10.0", 10, 0},
		{"0.1", 0, 1},
		{"8", 8, 0},
		{"", 0, 0},
	}

	for _, tt := range tests {
		t.Run(tt.input, func(t *testing.T) {
			major, minor := parseVersion(tt.input)
			if major != tt.wantMajor || minor != tt.wantMinor {
				t.Errorf("parseVersion(%q) = (%d, %d), want (%d, %d)", tt.input, major, minor, tt.wantMajor, tt.wantMinor)
			}
		})
	}
}

func TestCompareVersions(t *testing.T) {
	tests := []struct {
		a, b string
		want int
	}{
		{"8.6", "8.6", 0},
		{"8.7", "8.6", 1},
		{"8.6", "8.7", -1},
		{"8.9", "8.6", 1},
		{"9.0", "8.9", 1},
		{"8.9", "9.0", -1},
	}

	for _, tt := range tests {
		t.Run(tt.a+"_vs_"+tt.b, func(t *testing.T) {
			got := compareVersions(tt.a, tt.b)
			if got != tt.want {
				t.Errorf("compareVersions(%q, %q) = %d, want %d", tt.a, tt.b, got, tt.want)
			}
		})
	}
}

func TestMatchesVersion(t *testing.T) {
	tests := []struct {
		constraint string
		version    string
		want       bool
	}{
		// Exact match
		{"==8.9", "8.9", true},
		{"==8.9", "8.8", false},
		// Less than or equal
		{"<=8.7", "8.6", true},
		{"<=8.7", "8.7", true},
		{"<=8.7", "8.8", false},
		{"<=8.7", "8.9", false},
		// Greater than or equal
		{">=8.8", "8.8", true},
		{">=8.8", "8.9", true},
		{">=8.8", "8.7", false},
		// Strict less than
		{"<8.8", "8.7", true},
		{"<8.8", "8.8", false},
		// Strict greater than
		{">8.7", "8.8", true},
		{">8.7", "8.7", false},
		// No operator means ==
		{"8.9", "8.9", true},
		{"8.9", "8.8", false},
		// Empty constraint
		{"", "8.9", false},
	}

	for _, tt := range tests {
		t.Run(tt.constraint+"_"+tt.version, func(t *testing.T) {
			got := matchesVersion(tt.constraint, tt.version)
			if got != tt.want {
				t.Errorf("matchesVersion(%q, %q) = %v, want %v", tt.constraint, tt.version, got, tt.want)
			}
		})
	}
}

// --- Flow filtering tests ---

func TestFilterFlows(t *testing.T) {
	pf := &PermittedFlows{
		Rules: []PermittedFlowRule{
			{Match: "<=8.7", Deny: []string{"upgrade-minor"}},
			{Match: "==8.9", Deny: []string{"upgrade-patch", "upgrade-minor"}},
		},
	}

	tests := []struct {
		name    string
		version string
		flows   []string
		want    []string
	}{
		{
			name:    "8.6 denies upgrade-minor",
			version: "8.6",
			flows:   []string{"install", "upgrade-patch", "upgrade-minor"},
			want:    []string{"install", "upgrade-patch"},
		},
		{
			name:    "8.7 denies upgrade-minor",
			version: "8.7",
			flows:   []string{"install", "upgrade-patch", "upgrade-minor"},
			want:    []string{"install", "upgrade-patch"},
		},
		{
			name:    "8.8 allows all flows",
			version: "8.8",
			flows:   []string{"install", "upgrade-patch", "upgrade-minor"},
			want:    []string{"install", "upgrade-patch", "upgrade-minor"},
		},
		{
			name:    "8.9 only allows install",
			version: "8.9",
			flows:   []string{"install", "upgrade-patch", "upgrade-minor"},
			want:    []string{"install"},
		},
		{
			name:    "8.9 with only install",
			version: "8.9",
			flows:   []string{"install"},
			want:    []string{"install"},
		},
		{
			name:    "8.9 with only denied flows returns empty",
			version: "8.9",
			flows:   []string{"upgrade-patch", "upgrade-minor"},
			want:    nil,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := FilterFlows(pf, tt.version, tt.flows)
			if !sliceEqual(got, tt.want) {
				t.Errorf("FilterFlows(pf, %q, %v) = %v, want %v", tt.version, tt.flows, got, tt.want)
			}
		})
	}
}

// --- Matrix filter tests ---

func TestFilter(t *testing.T) {
	entries := []Entry{
		{Version: "8.8", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", Platform: "gke", Enabled: true},
		{Version: "8.8", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", Platform: "eks", Enabled: true},
		{Version: "8.8", Scenario: "elasticsearch", Shortname: "eshy", Auth: "hybrid", Flow: "install", Platform: "", Enabled: true},
		{Version: "8.8", Scenario: "oidc", Shortname: "esoi", Auth: "oidc", Flow: "upgrade-minor", Enabled: true},
		{Version: "8.9", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", Platform: "gke", Enabled: true},
		{Version: "8.9", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", Platform: "eks", Enabled: true},
	}

	t.Run("no filter returns all", func(t *testing.T) {
		got := Filter(entries, FilterOptions{})
		if len(got) != len(entries) {
			t.Errorf("Filter with no options: got %d entries, want %d", len(got), len(entries))
		}
	})

	t.Run("scenario filter", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ScenarioFilter: "oidc"})
		if len(got) != 1 || got[0].Scenario != "oidc" {
			t.Errorf("Filter(scenario=oidc): got %d entries, want 1 oidc entry", len(got))
		}
	})

	t.Run("scenario filter multiple comma-separated", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ScenarioFilter: "oidc,elasticsearch"})
		// Should match 1 oidc + 5 elasticsearch entries = 6 total
		if len(got) != 6 {
			t.Errorf("Filter(scenario=oidc,elasticsearch): got %d entries, want 6", len(got))
		}
		for _, e := range got {
			if e.Scenario != "oidc" && e.Scenario != "elasticsearch" {
				t.Errorf("Filter(scenario=oidc,elasticsearch): unexpected scenario %q", e.Scenario)
			}
		}
	})

	t.Run("scenario filter with spaces around commas", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ScenarioFilter: " oidc , elasticsearch "})
		if len(got) != 6 {
			t.Errorf("Filter(scenario=' oidc , elasticsearch '): got %d entries, want 6", len(got))
		}
	})

	t.Run("flow filter", func(t *testing.T) {
		got := Filter(entries, FilterOptions{FlowFilter: "upgrade-minor"})
		if len(got) != 1 || got[0].Flow != "upgrade-minor" {
			t.Errorf("Filter(flow=upgrade-minor): got %d entries, want 1", len(got))
		}
	})

	t.Run("platform filter gke", func(t *testing.T) {
		got := Filter(entries, FilterOptions{Platform: "gke"})
		// Entries with platform="gke" match, entries with platform="" also match (no restriction)
		if len(got) != 4 {
			t.Errorf("Filter(platform=gke): got %d entries, want 4", len(got))
		}
	})

	t.Run("platform filter eks", func(t *testing.T) {
		got := Filter(entries, FilterOptions{Platform: "eks"})
		// Entries with platform="eks" match, entries with platform="" also match (no restriction)
		if len(got) != 4 {
			t.Errorf("Filter(platform=eks): got %d entries, want 4", len(got))
		}
	})

	t.Run("platform filter rosa", func(t *testing.T) {
		got := Filter(entries, FilterOptions{Platform: "rosa"})
		// Only entries with platform="" (no restriction) match
		if len(got) != 2 {
			t.Errorf("Filter(platform=rosa): got %d entries, want 2 (entries with no platform restriction)", len(got))
		}
	})

	t.Run("shortname filter single", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ShortnameFilter: "esoi"})
		if len(got) != 1 || got[0].Shortname != "esoi" {
			t.Errorf("Filter(shortname=esoi): got %d entries, want 1 esoi entry", len(got))
		}
	})

	t.Run("shortname filter comma-separated", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ShortnameFilter: "eshy,esoi"})
		// Should match 1 eshy + 1 esoi = 2 total
		if len(got) != 2 {
			t.Errorf("Filter(shortname=eshy,esoi): got %d entries, want 2", len(got))
		}
		for _, e := range got {
			if e.Shortname != "eshy" && e.Shortname != "esoi" {
				t.Errorf("Filter(shortname=eshy,esoi): unexpected shortname %q", e.Shortname)
			}
		}
	})

	t.Run("shortname filter with spaces around commas", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ShortnameFilter: " eshy , esoi "})
		if len(got) != 2 {
			t.Errorf("Filter(shortname=' eshy , esoi '): got %d entries, want 2", len(got))
		}
	})

	t.Run("shortname filter substring match", func(t *testing.T) {
		// "esk" should match all entries with shortname "eske" (4 entries across 8.8 and 8.9)
		got := Filter(entries, FilterOptions{ShortnameFilter: "esk"})
		if len(got) != 4 {
			t.Errorf("Filter(shortname=esk): got %d entries, want 4", len(got))
		}
		for _, e := range got {
			if e.Shortname != "eske" {
				t.Errorf("Filter(shortname=esk): unexpected shortname %q", e.Shortname)
			}
		}
	})

	t.Run("shortname filter combined with scenario filter", func(t *testing.T) {
		// scenario=elasticsearch AND shortname=eshy → only the eshy entry
		got := Filter(entries, FilterOptions{ScenarioFilter: "elasticsearch", ShortnameFilter: "eshy"})
		if len(got) != 1 || got[0].Shortname != "eshy" {
			t.Errorf("Filter(scenario=elasticsearch,shortname=eshy): got %d entries, want 1 eshy entry", len(got))
		}
	})

	t.Run("shortname filter combined with flow filter", func(t *testing.T) {
		// shortname=esoi AND flow=upgrade-minor → 1 entry
		got := Filter(entries, FilterOptions{ShortnameFilter: "esoi", FlowFilter: "upgrade-minor"})
		if len(got) != 1 || got[0].Shortname != "esoi" {
			t.Errorf("Filter(shortname=esoi,flow=upgrade-minor): got %d entries, want 1", len(got))
		}
	})

	t.Run("shortname filter no match", func(t *testing.T) {
		got := Filter(entries, FilterOptions{ShortnameFilter: "zzzz"})
		if len(got) != 0 {
			t.Errorf("Filter(shortname=zzzz): got %d entries, want 0", len(got))
		}
	})

	t.Run("shortname exact match filters precisely", func(t *testing.T) {
		// "es" with ShortnameExact=true should NOT match "eske" or "eshy" or "esoi"
		got := Filter(entries, FilterOptions{ShortnameFilter: "es", ShortnameExact: true})
		if len(got) != 0 {
			t.Errorf("Filter(shortname=es, exact=true): got %d entries, want 0 (no entry has shortname exactly 'es')", len(got))
		}
	})

	t.Run("shortname exact match finds exact shortname", func(t *testing.T) {
		// "eske" with ShortnameExact=true should match all entries with shortname=="eske"
		got := Filter(entries, FilterOptions{ShortnameFilter: "eske", ShortnameExact: true})
		if len(got) != 4 {
			t.Errorf("Filter(shortname=eske, exact=true): got %d entries, want 4", len(got))
		}
		for _, e := range got {
			if e.Shortname != "eske" {
				t.Errorf("Filter(shortname=eske, exact=true): unexpected shortname %q", e.Shortname)
			}
		}
	})

	t.Run("shortname exact with substring does not match", func(t *testing.T) {
		// "esk" with ShortnameExact=true should NOT match "eske" (substring match disabled)
		got := Filter(entries, FilterOptions{ShortnameFilter: "esk", ShortnameExact: true})
		if len(got) != 0 {
			t.Errorf("Filter(shortname=esk, exact=true): got %d entries, want 0", len(got))
		}
	})

	t.Run("shortname exact with comma-separated values", func(t *testing.T) {
		// "eske,esoi" with ShortnameExact=true should match those exact shortnames
		got := Filter(entries, FilterOptions{ShortnameFilter: "eske,esoi", ShortnameExact: true})
		if len(got) != 5 {
			t.Errorf("Filter(shortname=eske,esoi, exact=true): got %d entries, want 5 (4 eske + 1 esoi)", len(got))
		}
		for _, e := range got {
			if e.Shortname != "eske" && e.Shortname != "esoi" {
				t.Errorf("Filter(shortname=eske,esoi, exact=true): unexpected shortname %q", e.Shortname)
			}
		}
	})

	t.Run("shortname non-exact allows substring match", func(t *testing.T) {
		// Confirm the default (ShortnameExact=false) still does substring matching
		// "esk" should match "eske" entries
		got := Filter(entries, FilterOptions{ShortnameFilter: "esk", ShortnameExact: false})
		if len(got) != 4 {
			t.Errorf("Filter(shortname=esk, exact=false): got %d entries, want 4", len(got))
		}
	})

	t.Run("scenario+shortname fallback to scenario only when shortname unmatched", func(t *testing.T) {
		// When scenario filter matches but shortname doesn't match anything,
		// the fallback drops the shortname filter and uses scenario alone.
		// "oidc" scenario exists, but shortname "dynamic-xyz" doesn't.
		got := Filter(entries, FilterOptions{ScenarioFilter: "oidc", ShortnameFilter: "dynamic-xyz", ShortnameExact: true})
		// Should fall back to scenario-only filter and find the oidc entry
		if len(got) != 1 || got[0].Scenario != "oidc" {
			t.Errorf("Filter(scenario=oidc, shortname=dynamic-xyz, exact=true): got %d entries, want 1 oidc entry (fallback)", len(got))
		}
	})

	t.Run("scenario+shortname no fallback when shortname matches", func(t *testing.T) {
		// When both filters match, use the combined AND result (no fallback needed).
		got := Filter(entries, FilterOptions{ScenarioFilter: "elasticsearch", ShortnameFilter: "eske", ShortnameExact: true})
		// Should match entries with scenario containing "elasticsearch" AND shortname exactly "eske"
		if len(got) != 4 {
			t.Errorf("Filter(scenario=elasticsearch, shortname=eske, exact=true): got %d entries, want 4", len(got))
		}
	})

	t.Run("scenario+shortname fallback not triggered without scenario filter", func(t *testing.T) {
		// Without a scenario filter, shortname-only filter that matches nothing returns empty.
		got := Filter(entries, FilterOptions{ShortnameFilter: "dynamic-xyz", ShortnameExact: true})
		if len(got) != 0 {
			t.Errorf("Filter(shortname=dynamic-xyz, exact=true, no scenario): got %d entries, want 0", len(got))
		}
	})

	// --- Tier filter tests ---
	tieredEntries := []Entry{
		{Version: "8.9", Scenario: "elasticsearch", Shortname: "eske", Flow: "install", Tier: 1, Enabled: true},
		{Version: "8.9", Scenario: "opensearch-external", Shortname: "osex", Flow: "install", Tier: 1, Enabled: true},
		{Version: "8.9", Scenario: "keycloak-mt", Shortname: "kemt", Flow: "install", Tier: 2, Enabled: true},
		{Version: "8.9", Scenario: "keycloak-rba", Shortname: "kerba", Flow: "install", Tier: 2, Enabled: true},
		{Version: "8.9", Scenario: "no-tier-set", Shortname: "notier", Flow: "install", Tier: 0, Enabled: true},
	}

	t.Run("tier filter returns only matching tier", func(t *testing.T) {
		got := Filter(tieredEntries, FilterOptions{Tier: 1})
		if len(got) != 3 {
			t.Errorf("Filter(tier=1): got %d entries, want 3 (2 tier-1 + 1 untiered)", len(got))
		}
		for _, e := range got {
			if e.Tier != 1 && e.Tier != 0 {
				t.Errorf("Filter(tier=1): unexpected tier %d for %s", e.Tier, e.Shortname)
			}
		}
	})

	t.Run("tier filter 2 returns tier-2 and untiered", func(t *testing.T) {
		got := Filter(tieredEntries, FilterOptions{Tier: 2})
		if len(got) != 3 {
			t.Errorf("Filter(tier=2): got %d entries, want 3 (2 tier-2 + 1 untiered)", len(got))
		}
		for _, e := range got {
			if e.Tier != 2 && e.Tier != 0 {
				t.Errorf("Filter(tier=2): unexpected tier %d for %s", e.Tier, e.Shortname)
			}
		}
	})

	t.Run("no tier filter returns all entries", func(t *testing.T) {
		got := Filter(tieredEntries, FilterOptions{})
		if len(got) != len(tieredEntries) {
			t.Errorf("Filter(no tier): got %d entries, want %d", len(got), len(tieredEntries))
		}
	})

	t.Run("tier filter combined with scenario filter", func(t *testing.T) {
		got := Filter(tieredEntries, FilterOptions{Tier: 1, ScenarioFilter: "elasticsearch"})
		if len(got) != 1 || got[0].Shortname != "eske" {
			t.Errorf("Filter(tier=1, scenario=elasticsearch): got %d entries, want 1 eske", len(got))
		}
	})
}

// --- GroupByVersion / VersionOrder tests ---

func TestGroupByVersionAndOrder(t *testing.T) {
	entries := []Entry{
		{Version: "8.9", Scenario: "es"},
		{Version: "8.8", Scenario: "es"},
		{Version: "8.8", Scenario: "oidc"},
		{Version: "8.9", Scenario: "os"},
	}

	groups := GroupByVersion(entries)
	if len(groups["8.8"]) != 2 {
		t.Errorf("GroupByVersion 8.8: got %d, want 2", len(groups["8.8"]))
	}
	if len(groups["8.9"]) != 2 {
		t.Errorf("GroupByVersion 8.9: got %d, want 2", len(groups["8.9"]))
	}

	order := VersionOrder(entries)
	if len(order) != 2 || order[0] != "8.9" || order[1] != "8.8" {
		t.Errorf("VersionOrder: got %v, want [8.9 8.8]", order)
	}
}

// --- Print tests ---

func TestPrintTable(t *testing.T) {
	entries := []Entry{
		{Version: "8.8", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", Platform: "gke", InfraType: "distroci", Enabled: true},
	}
	output, err := Print(entries, "table")
	if err != nil {
		t.Fatalf("Print(table): %v", err)
	}
	if output == "" {
		t.Error("Print(table): empty output")
	}
	if !strings.Contains(output, "elasticsearch") || !strings.Contains(output, "8.8") || !strings.Contains(output, "Total: 1") {
		t.Errorf("Print(table): missing expected content in output: %s", output)
	}
	if !strings.Contains(output, "INFRA-TYPE") {
		t.Errorf("Print(table): missing INFRA-TYPE header in output: %s", output)
	}
	if !strings.Contains(output, "distroci") {
		t.Errorf("Print(table): missing infra-type value 'distroci' in output: %s", output)
	}
}

func TestPrintJSON(t *testing.T) {
	entries := []Entry{
		{Version: "8.8", Scenario: "elasticsearch", Shortname: "eske", Auth: "keycloak", Flow: "install", InfraType: "distroci", Enabled: true},
	}
	output, err := Print(entries, "json")
	if err != nil {
		t.Fatalf("Print(json): %v", err)
	}
	if !strings.Contains(output, `"version": "8.8"`) || !strings.Contains(output, `"scenario": "elasticsearch"`) {
		t.Errorf("Print(json): missing expected JSON content in output: %s", output)
	}
	if !strings.Contains(output, `"infraType": "distroci"`) {
		t.Errorf("Print(json): missing infraType in JSON output: %s", output)
	}
}

func TestPrintInvalidFormat(t *testing.T) {
	_, err := Print(nil, "xml")
	if err == nil {
		t.Error("Print(xml): expected error for unknown format")
	}
}

func TestPrintTableEmpty(t *testing.T) {
	output, err := Print(nil, "table")
	if err != nil {
		t.Fatalf("Print(table, empty): %v", err)
	}
	if !strings.Contains(output, "No matrix entries found") {
		t.Errorf("Print(table, empty): expected 'No matrix entries found', got: %s", output)
	}
}

// --- Integration tests using real repo config files ---

func TestGenerateWithRealConfigs(t *testing.T) {
	repoRoot := findRepoRoot(t)

	entries, err := Generate(repoRoot, GenerateOptions{})
	if err != nil {
		t.Fatalf("Generate: %v", err)
	}

	if len(entries) == 0 {
		t.Fatal("Generate: expected entries, got 0")
	}

	// Verify we have entries for multiple versions
	versions := VersionOrder(entries)
	if len(versions) < 2 {
		t.Errorf("Generate: expected entries for at least 2 versions, got %d: %v", len(versions), versions)
	}

	// Verify no denied flows leaked through (must stay in sync with permitted-flows.yaml)
	for _, e := range entries {
		if e.Version == "8.9" && e.Flow == "upgrade-patch" {
			t.Errorf("Generate: 8.9 entry has denied flow %q (scenario=%s)", e.Flow, e.Scenario)
		}
		if (e.Version == "8.6" || e.Version == "8.7") && e.Flow == "upgrade-minor" {
			t.Errorf("Generate: %s entry has denied flow upgrade-minor (scenario=%s)", e.Version, e.Scenario)
		}
	}

	// Verify all entries are enabled (default behavior)
	for _, e := range entries {
		if !e.Enabled {
			t.Errorf("Generate: entry %s/%s is disabled but should be filtered out by default", e.Version, e.Scenario)
		}
	}

	// Verify infra-type is resolved for entries from versions that have it configured (8.8+).
	// All entries should have a non-empty InfraType (defaulting to "preemptible").
	for _, e := range entries {
		if e.InfraType == "" {
			t.Errorf("Generate: entry %s/%s (platform=%s) has empty InfraType; expected at least 'preemptible'",
				e.Version, e.Scenario, e.Platform)
		}
	}
}

func TestGenerateWithVersionFilter(t *testing.T) {
	repoRoot := findRepoRoot(t)

	entries, err := Generate(repoRoot, GenerateOptions{
		Versions: []string{"8.8"},
	})
	if err != nil {
		t.Fatalf("Generate(versions=8.8): %v", err)
	}

	for _, e := range entries {
		if e.Version != "8.8" {
			t.Errorf("Generate(versions=8.8): unexpected version %s", e.Version)
		}
	}
}

func TestGenerateWithIncludeDisabled(t *testing.T) {
	repoRoot := findRepoRoot(t)

	withDisabled, err := Generate(repoRoot, GenerateOptions{IncludeDisabled: true})
	if err != nil {
		t.Fatalf("Generate(includeDisabled): %v", err)
	}

	withoutDisabled, err := Generate(repoRoot, GenerateOptions{IncludeDisabled: false})
	if err != nil {
		t.Fatalf("Generate(no includeDisabled): %v", err)
	}

	if len(withDisabled) < len(withoutDisabled) {
		t.Errorf("Generate: withDisabled (%d) < withoutDisabled (%d); including disabled should never reduce entries",
			len(withDisabled), len(withoutDisabled))
	} else if len(withDisabled) == len(withoutDisabled) {
		t.Logf("Generate: withDisabled=%d == withoutDisabled=%d (all scenarios may be enabled)",
			len(withDisabled), len(withoutDisabled))
	}
}

func TestGenerateInvalidVersion(t *testing.T) {
	repoRoot := findRepoRoot(t)

	_, err := Generate(repoRoot, GenerateOptions{
		Versions: []string{"99.99"},
	})
	if err == nil {
		t.Error("Generate(versions=99.99): expected error for invalid version")
	}
}

// --- Config loader tests ---

func TestLoadChartVersions(t *testing.T) {
	repoRoot := findRepoRoot(t)

	cv, err := LoadChartVersions(repoRoot)
	if err != nil {
		t.Fatalf("LoadChartVersions: %v", err)
	}

	active := cv.ActiveVersions()
	if len(active) == 0 {
		t.Fatal("LoadChartVersions: no active versions")
	}

	// 8.10 should be alpha
	found := false
	for _, v := range cv.CamundaVersions.Alpha {
		if v == "8.10" {
			found = true
		}
	}
	if !found {
		t.Error("LoadChartVersions: 8.10 not found in alpha")
	}
}

func TestLoadPermittedFlows(t *testing.T) {
	repoRoot := findRepoRoot(t)

	pf, err := LoadPermittedFlows(repoRoot)
	if err != nil {
		t.Fatalf("LoadPermittedFlows: %v", err)
	}

	if len(pf.Defaults.Flows) == 0 {
		t.Error("LoadPermittedFlows: no default flows")
	}
	if len(pf.Rules) == 0 {
		t.Error("LoadPermittedFlows: no rules")
	}
}

func TestLoadCITestConfig(t *testing.T) {
	repoRoot := findRepoRoot(t)

	chartDir := filepath.Join(repoRoot, "charts", "camunda-platform-8.8")
	cfg, err := LoadCITestConfig(chartDir)
	if err != nil {
		t.Fatalf("LoadCITestConfig: %v", err)
	}

	if len(cfg.Integration.Case.PR.Scenarios) == 0 {
		t.Error("LoadCITestConfig: no PR scenarios")
	}
}

// --- HelmVersion passthrough ---

func TestHelmVersionPassthrough(t *testing.T) {
	// Decode a minimal scenario YAML and confirm HelmVersion loads.
	src := []byte(`
name: elasticsearch
enabled: true
shortname: eske
flow: install
helmVersion: "4.0.0"
`)
	var s CIScenario
	if err := yaml.Unmarshal(src, &s); err != nil {
		t.Fatalf("yaml.Unmarshal: %v", err)
	}
	if s.HelmVersion != "4.0.0" {
		t.Errorf("CIScenario.HelmVersion = %q, want %q", s.HelmVersion, "4.0.0")
	}

	// Marshal an Entry carrying HelmVersion and confirm the JSON key is
	// `helmVersion` — GitHub Actions matrix expressions rely on this exact key.
	e := Entry{Version: "8.10", Scenario: "elasticsearch", Flow: "install", HelmVersion: "4.0.0"}
	b, err := json.Marshal(e)
	if err != nil {
		t.Fatalf("json.Marshal: %v", err)
	}
	if !strings.Contains(string(b), `"helmVersion":"4.0.0"`) {
		t.Errorf("Entry JSON missing helmVersion key: %s", b)
	}

	// Empty HelmVersion must be omitted from JSON so existing scenarios stay
	// noise-free in the matrix output.
	eEmpty := Entry{Version: "8.10", Scenario: "elasticsearch", Flow: "install"}
	bEmpty, err := json.Marshal(eEmpty)
	if err != nil {
		t.Fatalf("json.Marshal empty: %v", err)
	}
	if strings.Contains(string(bEmpty), "helmVersion") {
		t.Errorf("empty HelmVersion leaked into JSON: %s", bEmpty)
	}
}

// --- RunSummary test ---

func TestPrintRunSummary(t *testing.T) {
	results := []RunResult{
		{Entry: Entry{Version: "8.8", Scenario: "es", Shortname: "eske", Flow: "install"}, Namespace: "matrix-88-eske"},
		{Entry: Entry{Version: "8.8", Scenario: "oidc", Shortname: "esoi", Flow: "install"}, Namespace: "matrix-88-esoi", Error: os.ErrNotExist},
	}

	summary := PrintRunSummary(results, 10*time.Second, "")
	if !strings.Contains(summary, "Total:   2") || !strings.Contains(summary, "Success: 1") || !strings.Contains(summary, "Failed:  1") {
		t.Errorf("PrintRunSummary: unexpected output: %s", summary)
	}
	if !strings.Contains(summary, "oidc") {
		t.Errorf("PrintRunSummary: expected failed entry in output: %s", summary)
	}
	// Non-HelmError should use the fallback "Error:" format
	if !strings.Contains(summary, "Error: file does not exist") {
		t.Errorf("PrintRunSummary: expected 'Error:' line for non-HelmError: %s", summary)
	}
	// Should show wall-clock total time
	if !strings.Contains(summary, "Total time:") {
		t.Errorf("PrintRunSummary: expected 'Total time:' line, got: %s", summary)
	}
}

func TestPrintRunSummaryParallelShowsSum(t *testing.T) {
	// Simulate parallel execution: two entries each took 30s, but wall-clock was 30s.
	results := []RunResult{
		{Entry: Entry{Version: "8.8", Scenario: "es", Shortname: "eske", Flow: "install"}, Namespace: "matrix-88-eske", Duration: 30 * time.Second},
		{Entry: Entry{Version: "8.8", Scenario: "os", Shortname: "oske", Flow: "install"}, Namespace: "matrix-88-oske", Duration: 30 * time.Second},
	}

	summary := PrintRunSummary(results, 30*time.Second, "")
	if !strings.Contains(summary, "Total time:") {
		t.Errorf("PrintRunSummary: expected 'Total time:' line, got: %s", summary)
	}
	// Sum (60s) > wall-clock (30s), so "Sum of entries" should appear.
	if !strings.Contains(summary, "Sum of entries:") {
		t.Errorf("PrintRunSummary: expected 'Sum of entries:' line for parallel run, got: %s", summary)
	}
}

func TestPrintRunSummarySequentialNoSum(t *testing.T) {
	// Simulate sequential execution: wall-clock equals sum.
	results := []RunResult{
		{Entry: Entry{Version: "8.8", Scenario: "es", Shortname: "eske", Flow: "install"}, Namespace: "matrix-88-eske", Duration: 30 * time.Second},
	}

	summary := PrintRunSummary(results, 30*time.Second, "")
	if !strings.Contains(summary, "Total time:") {
		t.Errorf("PrintRunSummary: expected 'Total time:' line, got: %s", summary)
	}
	// Sum equals wall-clock, so "Sum of entries" should NOT appear.
	if strings.Contains(summary, "Sum of entries:") {
		t.Errorf("PrintRunSummary: unexpected 'Sum of entries:' line for sequential run, got: %s", summary)
	}
}

func TestPrintRunSummaryHelmError(t *testing.T) {
	helmErr := &deployer.HelmError{
		Reason:  "helm upgrade --install failed",
		Command: "helm upgrade --install integration /very/long/path/to/charts/camunda-platform-8.9 -n ns --wait -f /tmp/long/path/base.yaml -f /tmp/long/path/gke.yaml",
		Cause:   fmt.Errorf("exit status 1"),
	}
	results := []RunResult{
		{Entry: Entry{Version: "8.9", Scenario: "elasticsearch-arm", Shortname: "esarm", Flow: "install"}, Namespace: "matrix-89-esarm", Error: helmErr},
	}

	summary := PrintRunSummary(results, 5*time.Second, "")

	// Should contain structured output
	if !strings.Contains(summary, "8.9/elasticsearch-arm (esarm, flow=install)") {
		t.Errorf("PrintRunSummary: expected entry header, got: %s", summary)
	}
	if !strings.Contains(summary, "Reason:  helm upgrade --install failed: exit status 1") {
		t.Errorf("PrintRunSummary: expected Reason line, got: %s", summary)
	}
	if !strings.Contains(summary, "Command:") {
		t.Errorf("PrintRunSummary: expected Command line, got: %s", summary)
	}
	// Command should have shortened paths
	if strings.Contains(summary, "/very/long/path/to/charts/") {
		t.Errorf("PrintRunSummary: expected shortened chart path, got: %s", summary)
	}
	if strings.Contains(summary, "/tmp/long/path/") {
		t.Errorf("PrintRunSummary: expected shortened values file paths, got: %s", summary)
	}
}

func TestPrintRunSummaryWrappedHelmError(t *testing.T) {
	helmErr := &deployer.HelmError{
		Reason:  "helm upgrade --install failed",
		Command: "helm upgrade --install integration camunda/camunda-platform -n ns --version 13.5.0 --wait -f /tmp/values.yaml",
		Cause:   fmt.Errorf("exit status 1"),
	}
	// Simulate two-step upgrade wrapping
	wrappedErr := fmt.Errorf("step 1: install camunda/camunda-platform@13.5.0 failed: %w", helmErr)
	results := []RunResult{
		{Entry: Entry{Version: "8.8", Scenario: "es", Shortname: "eske", Flow: "upgrade-patch"}, Namespace: "matrix-88-eske", Error: wrappedErr},
	}

	summary := PrintRunSummary(results, 5*time.Second, "")

	// Should contain step context
	if !strings.Contains(summary, "Step:") {
		t.Errorf("PrintRunSummary: expected Step line for wrapped error, got: %s", summary)
	}
	if !strings.Contains(summary, "step 1: install camunda/camunda-platform@13.5.0 failed") {
		t.Errorf("PrintRunSummary: expected step context in output, got: %s", summary)
	}
}

func TestPrintRunSummaryEmpty(t *testing.T) {
	summary := PrintRunSummary(nil, 0, "")
	if !strings.Contains(summary, "No entries executed") {
		t.Errorf("PrintRunSummary(nil): expected 'No entries executed', got: %s", summary)
	}
}

// --- buildNamespace tests ---

func TestBuildNamespace(t *testing.T) {
	tests := []struct {
		name   string
		prefix string
		entry  Entry
		want   string
	}{
		{
			name:   "install flow without platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Shortname: "eske", Flow: "install"},
			want:   "matrix-88-eske-inst",
		},
		{
			name:   "install flow with gke platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Shortname: "eske", Flow: "install", Platform: "gke"},
			want:   "matrix-88-eske-inst-gke",
		},
		{
			name:   "install flow with eks platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Shortname: "eske", Flow: "install", Platform: "eks"},
			want:   "matrix-88-eske-inst-eks",
		},
		{
			name:   "upgrade-patch flow with gke platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.7", Shortname: "es", Flow: "upgrade-patch", Platform: "gke"},
			want:   "matrix-87-es-upgp-gke",
		},
		{
			name:   "upgrade-minor flow without platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Shortname: "kemt", Flow: "upgrade-minor"},
			want:   "matrix-88-kemt-upgm",
		},
		{
			name:   "alpha version with platform",
			prefix: "matrix",
			entry:  Entry{Version: "8.9", Shortname: "oske", Flow: "install", Platform: "gke"},
			want:   "matrix-89-oske-inst-gke",
		},
		{
			name:   "custom prefix",
			prefix: "ci",
			entry:  Entry{Version: "8.6", Shortname: "kemt", Flow: "install"},
			want:   "ci-86-kemt-inst",
		},
		{
			name:   "falls back to scenario when shortname empty",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Scenario: "elasticsearch", Shortname: "", Flow: "install"},
			want:   "matrix-88-elasticsearch-inst",
		},
		{
			name:   "empty flow defaults to inst",
			prefix: "matrix",
			entry:  Entry{Version: "8.8", Shortname: "eske"},
			want:   "matrix-88-eske-inst",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := buildNamespace(tt.prefix, tt.entry)
			if got != tt.want {
				t.Errorf("buildNamespace(%q, entry) = %q, want %q", tt.prefix, got, tt.want)
			}
		})
	}
}

// --- flowAbbrev tests ---

func TestFlowAbbrev(t *testing.T) {
	tests := []struct {
		flow string
		want string
	}{
		{"install", "inst"},
		{"upgrade-patch", "upgp"},
		{"upgrade-minor", "upgm"},
		{"", "inst"},
		{"custom-flow-long", "cust"},
		{"abc", "abc"},
	}

	for _, tt := range tests {
		t.Run(tt.flow, func(t *testing.T) {
			got := flowAbbrev(tt.flow)
			if got != tt.want {
				t.Errorf("flowAbbrev(%q) = %q, want %q", tt.flow, got, tt.want)
			}
		})
	}
}

// --- ingressSubdomain tests ---

func TestIngressSubdomain(t *testing.T) {
	tests := []struct {
		name       string
		baseDomain string
		namespace  string
		want       string
	}{
		{
			name:       "returns namespace when baseDomain is set",
			baseDomain: "ci.distro.ultrawombat.com",
			namespace:  "matrix-89-eske",
			want:       "matrix-89-eske",
		},
		{
			name:       "returns empty when baseDomain is empty",
			baseDomain: "",
			namespace:  "matrix-89-eske",
			want:       "",
		},
		{
			name:       "works with custom namespace",
			baseDomain: "distribution.aws.camunda.cloud",
			namespace:  "ci-88-oske",
			want:       "ci-88-oske",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := ingressSubdomain(tt.baseDomain, tt.namespace)
			if got != tt.want {
				t.Errorf("ingressSubdomain(%q, %q) = %q, want %q", tt.baseDomain, tt.namespace, got, tt.want)
			}
		})
	}
}

// --- resolveKubeContext tests ---

func TestResolveKubeContext(t *testing.T) {
	tests := []struct {
		name     string
		opts     RunOptions
		platform string
		want     string
	}{
		{
			name:     "returns platform-specific context for gke",
			opts:     RunOptions{KubeContexts: map[string]string{"gke": "gke-ctx", "eks": "eks-ctx"}},
			platform: "gke",
			want:     "gke-ctx",
		},
		{
			name:     "returns platform-specific context for eks",
			opts:     RunOptions{KubeContexts: map[string]string{"gke": "gke-ctx", "eks": "eks-ctx"}},
			platform: "eks",
			want:     "eks-ctx",
		},
		{
			name:     "falls back to KubeContext when platform not in map",
			opts:     RunOptions{KubeContexts: map[string]string{"gke": "gke-ctx"}, KubeContext: "fallback-ctx"},
			platform: "eks",
			want:     "fallback-ctx",
		},
		{
			name:     "falls back to KubeContext when map is nil",
			opts:     RunOptions{KubeContext: "fallback-ctx"},
			platform: "gke",
			want:     "fallback-ctx",
		},
		{
			name:     "returns empty when nothing configured",
			opts:     RunOptions{},
			platform: "gke",
			want:     "",
		},
		{
			name:     "platform-specific takes priority over fallback",
			opts:     RunOptions{KubeContexts: map[string]string{"gke": "gke-ctx"}, KubeContext: "fallback-ctx"},
			platform: "gke",
			want:     "gke-ctx",
		},
		{
			name:     "skips empty string in map and falls back",
			opts:     RunOptions{KubeContexts: map[string]string{"gke": ""}, KubeContext: "fallback-ctx"},
			platform: "gke",
			want:     "fallback-ctx",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveKubeContext(tt.opts, tt.platform)
			if got != tt.want {
				t.Errorf("resolveKubeContext(opts, %q) = %q, want %q", tt.platform, got, tt.want)
			}
		})
	}
}

// --- resolvePlatform tests ---

func TestResolvePlatform(t *testing.T) {
	tests := []struct {
		name  string
		opts  RunOptions
		entry Entry
		want  string
	}{
		{
			name:  "opts.Platform overrides entry",
			opts:  RunOptions{Platform: "eks"},
			entry: Entry{Platform: "gke"},
			want:  "eks",
		},
		{
			name:  "uses entry platform when no override",
			opts:  RunOptions{},
			entry: Entry{Platform: "eks"},
			want:  "eks",
		},
		{
			name:  "defaults to gke when no platform set",
			opts:  RunOptions{},
			entry: Entry{},
			want:  "gke",
		},
		{
			name:  "defaults to gke when entry platform empty",
			opts:  RunOptions{},
			entry: Entry{Platform: ""},
			want:  "gke",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolvePlatform(tt.opts, tt.entry)
			if got != tt.want {
				t.Errorf("resolvePlatform(opts, entry) = %q, want %q", got, tt.want)
			}
		})
	}
}

// --- resolveEnvFile tests ---

func TestResolveEnvFile(t *testing.T) {
	tests := []struct {
		name    string
		opts    RunOptions
		version string
		want    string
	}{
		{
			name:    "version-specific file takes priority",
			opts:    RunOptions{EnvFiles: map[string]string{"8.9": ".env.89"}, EnvFile: ".env"},
			version: "8.9",
			want:    ".env.89",
		},
		{
			name:    "falls back to EnvFile when version not in map",
			opts:    RunOptions{EnvFiles: map[string]string{"8.9": ".env.89"}, EnvFile: ".env"},
			version: "8.8",
			want:    ".env",
		},
		{
			name:    "falls back to EnvFile when map is nil",
			opts:    RunOptions{EnvFile: ".env.default"},
			version: "8.7",
			want:    ".env.default",
		},
		{
			name:    "returns empty when nothing configured",
			opts:    RunOptions{},
			version: "8.6",
			want:    "",
		},
		{
			name:    "skips empty string in version map",
			opts:    RunOptions{EnvFiles: map[string]string{"8.8": ""}, EnvFile: ".env.fallback"},
			version: "8.8",
			want:    ".env.fallback",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveEnvFile(tt.opts, tt.version)
			if got != tt.want {
				t.Errorf("resolveEnvFile(opts, %q) = %q, want %q", tt.version, got, tt.want)
			}
		})
	}
}

// --- resolveUseVaultBackedSecrets tests ---

func TestResolveUseVaultBackedSecrets(t *testing.T) {
	tests := []struct {
		name     string
		opts     RunOptions
		platform string
		want     bool
	}{
		{
			name:     "returns platform-specific value for eks (true)",
			opts:     RunOptions{VaultBackedSecrets: map[string]bool{"eks": true, "gke": false}},
			platform: "eks",
			want:     true,
		},
		{
			name:     "returns platform-specific value for gke (false)",
			opts:     RunOptions{VaultBackedSecrets: map[string]bool{"eks": true, "gke": false}},
			platform: "gke",
			want:     false,
		},
		{
			name:     "falls back to UseVaultBackedSecrets when platform not in map",
			opts:     RunOptions{VaultBackedSecrets: map[string]bool{"gke": false}, UseVaultBackedSecrets: true},
			platform: "eks",
			want:     true,
		},
		{
			name:     "falls back to UseVaultBackedSecrets when map is nil",
			opts:     RunOptions{UseVaultBackedSecrets: true},
			platform: "gke",
			want:     true,
		},
		{
			name:     "returns false when nothing configured",
			opts:     RunOptions{},
			platform: "gke",
			want:     false,
		},
		{
			name:     "platform-specific false overrides fallback true",
			opts:     RunOptions{VaultBackedSecrets: map[string]bool{"gke": false}, UseVaultBackedSecrets: true},
			platform: "gke",
			want:     false,
		},
		{
			name:     "platform-specific true overrides fallback false",
			opts:     RunOptions{VaultBackedSecrets: map[string]bool{"eks": true}, UseVaultBackedSecrets: false},
			platform: "eks",
			want:     true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveUseVaultBackedSecrets(tt.opts, tt.platform)
			if got != tt.want {
				t.Errorf("resolveUseVaultBackedSecrets(opts, %q) = %v, want %v", tt.platform, got, tt.want)
			}
		})
	}
}

// --- resolveIngressBaseDomain tests ---

func TestResolveIngressBaseDomain(t *testing.T) {
	tests := []struct {
		name     string
		opts     RunOptions
		platform string
		want     string
	}{
		{
			name:     "returns platform-specific domain for gke",
			opts:     RunOptions{IngressBaseDomains: map[string]string{"gke": "ci.distro.ultrawombat.com", "eks": "distribution.aws.camunda.cloud"}},
			platform: "gke",
			want:     "ci.distro.ultrawombat.com",
		},
		{
			name:     "returns platform-specific domain for eks",
			opts:     RunOptions{IngressBaseDomains: map[string]string{"gke": "ci.distro.ultrawombat.com", "eks": "distribution.aws.camunda.cloud"}},
			platform: "eks",
			want:     "distribution.aws.camunda.cloud",
		},
		{
			name:     "falls back to IngressBaseDomain when platform not in map",
			opts:     RunOptions{IngressBaseDomains: map[string]string{"gke": "ci.distro.ultrawombat.com"}, IngressBaseDomain: "fallback.example.com"},
			platform: "eks",
			want:     "fallback.example.com",
		},
		{
			name:     "falls back to IngressBaseDomain when map is nil",
			opts:     RunOptions{IngressBaseDomain: "fallback.example.com"},
			platform: "gke",
			want:     "fallback.example.com",
		},
		{
			name:     "returns empty when nothing configured",
			opts:     RunOptions{},
			platform: "gke",
			want:     "",
		},
		{
			name:     "platform-specific takes priority over fallback",
			opts:     RunOptions{IngressBaseDomains: map[string]string{"gke": "ci.distro.ultrawombat.com"}, IngressBaseDomain: "fallback.example.com"},
			platform: "gke",
			want:     "ci.distro.ultrawombat.com",
		},
		{
			name:     "skips empty string in map and falls back",
			opts:     RunOptions{IngressBaseDomains: map[string]string{"gke": ""}, IngressBaseDomain: "fallback.example.com"},
			platform: "gke",
			want:     "fallback.example.com",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveIngressBaseDomain(tt.opts, tt.platform)
			if got != tt.want {
				t.Errorf("resolveIngressBaseDomain(opts, %q) = %q, want %q", tt.platform, got, tt.want)
			}
		})
	}
}

// --- resolveInfraType tests ---

func TestResolveInfraType(t *testing.T) {
	tests := []struct {
		name         string
		infraTypeMap map[string]string
		platform     string
		want         string
	}{
		{
			name:         "returns gke value from map",
			infraTypeMap: map[string]string{"gke": "distroci", "eks": "preemptible"},
			platform:     "gke",
			want:         "distroci",
		},
		{
			name:         "returns eks value from map",
			infraTypeMap: map[string]string{"gke": "distroci", "eks": "preemptible"},
			platform:     "eks",
			want:         "preemptible",
		},
		{
			name:         "returns arm for gke arm scenario",
			infraTypeMap: map[string]string{"gke": "arm"},
			platform:     "gke",
			want:         "arm",
		},
		{
			name:         "defaults to preemptible when platform not in map",
			infraTypeMap: map[string]string{"gke": "arm"},
			platform:     "eks",
			want:         "preemptible",
		},
		{
			name:         "defaults to preemptible when map is nil",
			infraTypeMap: nil,
			platform:     "gke",
			want:         "preemptible",
		},
		{
			name:         "defaults to preemptible when map is empty",
			infraTypeMap: map[string]string{},
			platform:     "gke",
			want:         "preemptible",
		},
		{
			name:         "defaults to preemptible when value is empty string",
			infraTypeMap: map[string]string{"gke": ""},
			platform:     "gke",
			want:         "preemptible",
		},
		{
			name:         "empty platform defaults to gke lookup",
			infraTypeMap: map[string]string{"gke": "distroci"},
			platform:     "",
			want:         "distroci",
		},
		{
			name:         "empty platform defaults to preemptible when gke not in map",
			infraTypeMap: map[string]string{"eks": "arm"},
			platform:     "",
			want:         "preemptible",
		},
		{
			name:         "empty platform defaults to preemptible when map is nil",
			infraTypeMap: nil,
			platform:     "",
			want:         "preemptible",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveInfraType(tt.infraTypeMap, tt.platform)
			if got != tt.want {
				t.Errorf("resolveInfraType(%v, %q) = %q, want %q", tt.infraTypeMap, tt.platform, got, tt.want)
			}
		})
	}
}

// --- helpers ---

func sliceEqual(a, b []string) bool {
	if len(a) == 0 && len(b) == 0 {
		return true
	}
	if len(a) != len(b) {
		return false
	}
	for i := range a {
		if a[i] != b[i] {
			return false
		}
	}
	return true
}

// TestSynthesizeRunError verifies the extracted synthesizeRunError helper that
// Run() uses to convert failed results and context cancellations into non-nil
// errors. This ensures CI steps get a non-zero exit code when deployments fail.
func TestSynthesizeRunError(t *testing.T) {
	tests := []struct {
		name         string
		results      []RunResult
		totalEntries int
		ctxCancelled bool
		wantErr      bool
		wantContains string // substring expected in error message
	}{
		{
			name: "all successful",
			results: []RunResult{
				{Namespace: "ns-1", Error: nil},
				{Namespace: "ns-2", Error: nil},
			},
			totalEntries: 2,
			wantErr:      false,
		},
		{
			name: "one failure",
			results: []RunResult{
				{Namespace: "ns-1", Error: nil},
				{Namespace: "ns-2", Error: errors.New("helm timeout")},
			},
			totalEntries: 2,
			wantErr:      true,
			wantContains: "1 of 2 matrix entries failed",
		},
		{
			name: "all failures",
			results: []RunResult{
				{Namespace: "ns-1", Error: errors.New("deploy failed")},
				{Namespace: "ns-2", Error: errors.New("helm timeout")},
			},
			totalEntries: 2,
			wantErr:      true,
			wantContains: "2 of 2 matrix entries failed",
		},
		{
			name:         "context cancelled before any entry dispatched",
			results:      nil,
			totalEntries: 3,
			ctxCancelled: true,
			wantErr:      true,
			wantContains: "run cancelled: 3 of 3 entries never started",
		},
		{
			name: "context cancelled with partial results",
			results: []RunResult{
				{Namespace: "ns-1", Error: nil},
			},
			totalEntries: 3,
			ctxCancelled: true,
			wantErr:      true,
			wantContains: "run cancelled: 2 of 3 entries never started",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			ctx := context.Background()
			if tt.ctxCancelled {
				var cancel context.CancelFunc
				ctx, cancel = context.WithCancel(ctx)
				cancel() // cancel immediately
			}

			err := synthesizeRunError(ctx, tt.results, tt.totalEntries)

			if tt.wantErr && err == nil {
				t.Errorf("expected error but got nil")
			}
			if !tt.wantErr && err != nil {
				t.Errorf("unexpected error: %v", err)
			}
			if tt.wantErr && err != nil {
				if !strings.Contains(err.Error(), tt.wantContains) {
					t.Errorf("error = %q, want substring %q", err.Error(), tt.wantContains)
				}
			}
		})
	}
}

// findRepoRoot walks up from the current working directory to find the repo root.
func findRepoRoot(t *testing.T) string {
	t.Helper()

	// Try working directory first
	wd, err := os.Getwd()
	if err != nil {
		t.Fatalf("os.Getwd: %v", err)
	}

	// Walk up until we find charts/chart-versions.yaml
	dir := wd
	for {
		if _, err := os.Stat(filepath.Join(dir, "charts", "chart-versions.yaml")); err == nil {
			return dir
		}
		parent := filepath.Dir(dir)
		if parent == dir {
			break
		}
		dir = parent
	}

	t.Skip("cannot find repo root (charts/chart-versions.yaml); skipping integration test")
	return ""
}

// --- lastNLines tests ---

func TestLastNLines(t *testing.T) {
	tests := []struct {
		name  string
		input string
		n     int
		want  string
	}{
		{
			name:  "empty string",
			input: "",
			n:     5,
			want:  "",
		},
		{
			name:  "fewer lines than n",
			input: "line1\nline2\nline3",
			n:     10,
			want:  "line1\nline2\nline3",
		},
		{
			name:  "exactly n lines",
			input: "line1\nline2\nline3",
			n:     3,
			want:  "line1\nline2\nline3",
		},
		{
			name:  "more lines than n",
			input: "line1\nline2\nline3\nline4\nline5",
			n:     3,
			want:  "line3\nline4\nline5",
		},
		{
			name:  "n is 1",
			input: "line1\nline2\nline3",
			n:     1,
			want:  "line3",
		},
		{
			name:  "trailing newline produces empty last element",
			input: "line1\nline2\n",
			n:     2,
			want:  "line2\n",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := lastNLines(tt.input, tt.n)
			if got != tt.want {
				t.Errorf("lastNLines(%q, %d) = %q, want %q", tt.input, tt.n, got, tt.want)
			}
		})
	}
}

// --- appendTestOutputToDiagnostics tests ---

func TestAppendTestOutputToDiagnostics_PlainError(t *testing.T) {
	// A plain error (no *TestError) should return diagPath unchanged.
	plainErr := fmt.Errorf("deployment timed out")
	result := appendTestOutputToDiagnostics(plainErr, "test-ns", "/some/path")
	if result != "/some/path" {
		t.Errorf("expected unchanged diagPath, got %q", result)
	}
}

func TestAppendTestOutputToDiagnostics_TestErrorEmptyOutput(t *testing.T) {
	// A *TestError with empty Output should return diagPath unchanged.
	te := &deploy.TestError{Err: fmt.Errorf("tests failed"), Output: ""}
	result := appendTestOutputToDiagnostics(te, "test-ns", "/some/path")
	if result != "/some/path" {
		t.Errorf("expected unchanged diagPath, got %q", result)
	}
}

func TestAppendTestOutputToDiagnostics_AppendToExistingRunDirectory(t *testing.T) {
	tmpDir := t.TempDir()
	runDir := filepath.Join(tmpDir, "diagnostics", "test-ns", "20260306T120000Z")
	if err := os.MkdirAll(filepath.Join(runDir, "logs"), 0o755); err != nil {
		t.Fatalf("setup: mkdir: %v", err)
	}

	initialSummary := diagnosticsSummary{
		Namespace:       "test-ns",
		CollectedAt:     "2026-03-06T12:00:00Z",
		PodLogTailLines: diagnosticsPodTailLines,
		Pods:            "NAME READY STATUS",
	}
	b, err := json.Marshal(initialSummary)
	if err != nil {
		t.Fatalf("setup: marshal summary: %v", err)
	}
	if err := os.WriteFile(filepath.Join(runDir, "summary.json"), b, 0o644); err != nil {
		t.Fatalf("setup: write summary: %v", err)
	}

	te := &deploy.TestError{
		Err:    fmt.Errorf("integration tests failed"),
		Output: "FAIL: TestSomething\nexpected 200, got 500\n",
	}

	result := appendTestOutputToDiagnostics(te, "test-ns", runDir)
	if result != runDir {
		t.Errorf("expected same diagPath %q, got %q", runDir, result)
	}

	content, err := os.ReadFile(filepath.Join(runDir, "test-output.txt"))
	if err != nil {
		t.Fatalf("read test-output: %v", err)
	}
	if !strings.Contains(string(content), "FAIL: TestSomething") {
		t.Errorf("test-output.txt should contain test output, got:\n%s", string(content))
	}

	summaryBytes, err := os.ReadFile(filepath.Join(runDir, "summary.json"))
	if err != nil {
		t.Fatalf("read summary: %v", err)
	}
	var summary diagnosticsSummary
	if err := json.Unmarshal(summaryBytes, &summary); err != nil {
		t.Fatalf("unmarshal summary: %v", err)
	}
	if summary.Namespace != "test-ns" {
		t.Errorf("expected namespace to be preserved, got %q", summary.Namespace)
	}
	if !strings.Contains(summary.TestOutputLast200, "FAIL: TestSomething") {
		t.Errorf("summary should contain test output, got:\n%s", summary.TestOutputLast200)
	}
}

func TestAppendTestOutputToDiagnostics_CreatesNewRunDirectory(t *testing.T) {
	// When diagPath is empty, the function should create a new run directory under diagnosticsDir.
	// We override diagnosticsDir by changing to a temp directory so the "diagnostics/"
	// subdir is created there instead of the real working directory.
	tmpDir := t.TempDir()

	// Save and restore working directory.
	origWd, err := os.Getwd()
	if err != nil {
		t.Fatalf("Getwd: %v", err)
	}
	if err := os.Chdir(tmpDir); err != nil {
		t.Fatalf("Chdir: %v", err)
	}
	t.Cleanup(func() { os.Chdir(origWd) })

	te := &deploy.TestError{
		Err:    fmt.Errorf("e2e tests failed"),
		Output: "FAIL: TestLogin\ntimeout waiting for element\n",
	}

	result := appendTestOutputToDiagnostics(te, "my-namespace", "")
	if result == "" {
		t.Fatal("expected a file path, got empty string")
	}
	if !strings.Contains(result, filepath.Join("diagnostics", "my-namespace")) {
		t.Errorf("expected diagnostics namespace path, got %q", result)
	}

	testOutput, err := os.ReadFile(filepath.Join(result, "test-output.txt"))
	if err != nil {
		t.Fatalf("read test output: %v", err)
	}
	if !strings.Contains(string(testOutput), "FAIL: TestLogin") {
		t.Errorf("new diagnostics should contain test output, got:\n%s", string(testOutput))
	}

	content, err := os.ReadFile(filepath.Join(result, "summary.json"))
	if err != nil {
		t.Fatalf("read summary file: %v", err)
	}

	var summary diagnosticsSummary
	if err := json.Unmarshal(content, &summary); err != nil {
		t.Fatalf("unmarshal summary: %v", err)
	}
	if summary.Namespace != "my-namespace" {
		t.Errorf("expected namespace my-namespace, got %q", summary.Namespace)
	}
	if !strings.Contains(summary.TestOutputLast200, "FAIL: TestLogin") {
		t.Errorf("summary should contain test output, got:\n%s", summary.TestOutputLast200)
	}
}

func TestAppendTestOutputToDiagnostics_WrappedTestError(t *testing.T) {
	// The error is typically wrapped by deploy.Execute: "post-deployment tests failed: <TestError>".
	// errors.As should still find the *TestError.
	te := &deploy.TestError{
		Err:    fmt.Errorf("test failures:\n  - integration: exit code 1"),
		Output: "=== integration test output ===\nFAIL: TestAPI\n",
	}
	wrapped := fmt.Errorf("post-deployment tests failed: %w", te)

	tmpDir := t.TempDir()
	runDir := filepath.Join(tmpDir, "diagnostics", "test-ns", "20260306T130000Z")
	if err := os.MkdirAll(filepath.Join(runDir, "logs"), 0o755); err != nil {
		t.Fatalf("setup mkdir: %v", err)
	}

	summary := diagnosticsSummary{Namespace: "test-ns", CollectedAt: "2026-03-06T13:00:00Z", PodLogTailLines: diagnosticsPodTailLines}
	b, err := json.Marshal(summary)
	if err != nil {
		t.Fatalf("setup marshal: %v", err)
	}
	if err := os.WriteFile(filepath.Join(runDir, "summary.json"), b, 0o644); err != nil {
		t.Fatalf("setup write summary: %v", err)
	}

	result := appendTestOutputToDiagnostics(wrapped, "test-ns", runDir)
	if result != runDir {
		t.Errorf("expected same diagPath, got %q", result)
	}

	content, err := os.ReadFile(filepath.Join(runDir, "summary.json"))
	if err != nil {
		t.Fatalf("read: %v", err)
	}

	var updated diagnosticsSummary
	if err := json.Unmarshal(content, &updated); err != nil {
		t.Fatalf("unmarshal updated summary: %v", err)
	}
	if !strings.Contains(updated.TestOutputLast200, "FAIL: TestAPI") {
		t.Errorf("should extract test output through wrapping, got:\n%s", updated.TestOutputLast200)
	}
}

// --- Bitnami PG password extraction tests ---

func TestBitnamiPGPasswordMapping_AllKeysPresent(t *testing.T) {
	// Verify that the mapping table covers all expected secret keys and Helm paths.
	expectedKeys := []string{
		"identity-keycloak-postgresql-user-password",
		"identity-keycloak-postgresql-admin-password",
		"webmodeler-postgresql-user-password",
		"webmodeler-postgresql-admin-password",
	}
	for _, key := range expectedKeys {
		if _, ok := bitnamiPGPasswordMapping[key]; !ok {
			t.Errorf("bitnamiPGPasswordMapping missing expected key %q", key)
		}
	}
}

func TestBitnamiPGPasswordMapping_HelmPaths(t *testing.T) {
	// Verify the exact Helm paths for each secret key.
	tests := []struct {
		secretKey     string
		wantHelmPaths []string
	}{
		{
			secretKey:     "identity-keycloak-postgresql-user-password",
			wantHelmPaths: []string{"identityKeycloak.postgresql.auth.password", "identityPostgresql.auth.password"},
		},
		{
			secretKey:     "identity-keycloak-postgresql-admin-password",
			wantHelmPaths: []string{"identityKeycloak.postgresql.auth.postgresPassword", "identityPostgresql.auth.postgresPassword"},
		},
		{
			secretKey:     "webmodeler-postgresql-user-password",
			wantHelmPaths: []string{"webModelerPostgresql.auth.password"},
		},
		{
			secretKey:     "webmodeler-postgresql-admin-password",
			wantHelmPaths: []string{"webModelerPostgresql.auth.postgresPassword"},
		},
	}

	for _, tt := range tests {
		t.Run(tt.secretKey, func(t *testing.T) {
			helmPaths, ok := bitnamiPGPasswordMapping[tt.secretKey]
			if !ok {
				t.Fatalf("key %q not found in mapping", tt.secretKey)
			}
			if len(helmPaths) != len(tt.wantHelmPaths) {
				t.Fatalf("expected %d helm paths, got %d", len(tt.wantHelmPaths), len(helmPaths))
			}
			for i, want := range tt.wantHelmPaths {
				if helmPaths[i] != want {
					t.Errorf("helm path [%d] = %q, want %q", i, helmPaths[i], want)
				}
			}
		})
	}
}

func TestBitnamiPGPasswordMapping_TotalOverrideCount(t *testing.T) {
	// With all 4 secret keys present, we should get 6 Helm overrides:
	// 2 (identityKeycloak + identityPostgresql) * 2 (user + admin) = 4, plus 2 webModeler = 6
	totalPaths := 0
	for _, paths := range bitnamiPGPasswordMapping {
		totalPaths += len(paths)
	}
	if totalPaths != 6 {
		t.Errorf("expected 6 total Helm paths across all mappings, got %d", totalPaths)
	}
}

func TestExtractBitnamiPGPasswords_NoCluster(t *testing.T) {
	// When there is no valid kube context, the function should return nil gracefully
	// (not panic or error) because it's designed for lenient degradation.
	result := extractBitnamiPGPasswords(context.Background(), "nonexistent-ns", "nonexistent-context")
	if result != nil {
		t.Errorf("expected nil when no cluster available, got %v", result)
	}
}

func TestExtractBitnamiPGPasswords_MappingConsistency(t *testing.T) {
	// Verify that all secret keys in the mapping produce unique, non-empty Helm paths.
	allPaths := make(map[string]string) // helmPath -> secretKey
	for secretKey, helmPaths := range bitnamiPGPasswordMapping {
		if len(helmPaths) == 0 {
			t.Errorf("secret key %q has no Helm paths", secretKey)
		}
		for _, hp := range helmPaths {
			if hp == "" {
				t.Errorf("secret key %q has empty Helm path", secretKey)
			}
			if prev, ok := allPaths[hp]; ok {
				t.Errorf("Helm path %q is duplicated: mapped by both %q and %q", hp, prev, secretKey)
			}
			allPaths[hp] = secretKey
		}
	}
}

// --- ChartRef override tests ---

func TestApplyChartRefOverride(t *testing.T) {
	// Verify that applyChartRefOverride correctly mutates ChartFlags when
	// RunOptions.ChartRef is set, and is a no-op when it is empty. This
	// exercises the same helper that executeEntry calls in production.
	tests := []struct {
		name            string
		chartRef        string
		chartRefVersion string
		wantApplied     bool
		wantChart       string
		wantVersion     string
		wantSkipDep     bool
	}{
		{
			name:            "OCI reference",
			chartRef:        "oci://registry.camunda.cloud/team-distribution/camunda-platform",
			chartRefVersion: "13-rc-latest",
			wantApplied:     true,
			wantChart:       "oci://registry.camunda.cloud/team-distribution/camunda-platform",
			wantVersion:     "13-rc-latest",
			wantSkipDep:     true,
		},
		{
			name:            "local tgz path",
			chartRef:        "/tmp/oci-chart/camunda-platform-13.4.0-rc.tgz",
			chartRefVersion: "",
			wantApplied:     true,
			wantChart:       "/tmp/oci-chart/camunda-platform-13.4.0-rc.tgz",
			wantVersion:     "",
			wantSkipDep:     true,
		},
		{
			name:            "empty chart-ref does not override",
			chartRef:        "",
			chartRefVersion: "",
			wantApplied:     false,
			wantChart:       "",
			wantVersion:     "",
			wantSkipDep:     false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			opts := RunOptions{
				ChartRef:        tt.chartRef,
				ChartRefVersion: tt.chartRefVersion,
			}

			chart := &config.ChartFlags{
				ChartPath:            "/path/to/charts/camunda-platform-8.9",
				SkipDependencyUpdate: false,
			}

			applied := applyChartRefOverride(chart, opts)

			if applied != tt.wantApplied {
				t.Errorf("applyChartRefOverride returned %v, want %v", applied, tt.wantApplied)
			}
			if chart.Chart != tt.wantChart {
				t.Errorf("Chart = %q, want %q", chart.Chart, tt.wantChart)
			}
			if chart.ChartVersion != tt.wantVersion {
				t.Errorf("ChartVersion = %q, want %q", chart.ChartVersion, tt.wantVersion)
			}
			if chart.SkipDependencyUpdate != tt.wantSkipDep {
				t.Errorf("SkipDependencyUpdate = %v, want %v", chart.SkipDependencyUpdate, tt.wantSkipDep)
			}
			// ChartPath must always be preserved for values resolution.
			if chart.ChartPath != "/path/to/charts/camunda-platform-8.9" {
				t.Errorf("ChartPath should be preserved, got %q", chart.ChartPath)
			}
		})
	}
}

func TestChartRefOverride_UpgradeStep1Unaffected(t *testing.T) {
	// Verify that when ChartRef is set, Step 1 of an upgrade flow still uses
	// the DefaultHelmChartRef (from versionmatrix), not the ChartRef override.
	// This is because executeTwoStepUpgrade creates step1Flags independently.
	opts := RunOptions{
		ChartRef:        "oci://registry.camunda.cloud/team-distribution/camunda-platform",
		ChartRefVersion: "13-rc-latest",
	}

	// Apply the override the same way executeEntry does.
	baseFlags := &config.ChartFlags{
		ChartPath: "/path/to/charts/camunda-platform-8.9",
	}
	if !applyChartRefOverride(baseFlags, opts) {
		t.Fatal("applyChartRefOverride returned false for non-empty ChartRef")
	}

	// Simulate what executeTwoStepUpgrade does for Step 1:
	// step1Flags := *flags
	// step1Flags.Chart.Chart = versionmatrix.DefaultHelmChartRef
	step1Flags := *baseFlags
	step1Flags.Chart = versionmatrix.DefaultHelmChartRef
	step1Flags.ChartVersion = "12.5.0"     // Previous version
	step1Flags.ChartPath = ""              // Use repo chart, not local path
	step1Flags.SkipDependencyUpdate = true // Repo charts don't need dep update
	step1Flags.ChartRootOverlays = nil     // No overlays for Step 1

	// Step 1 should use the Helm repo ref, not the OCI override.
	if step1Flags.Chart != versionmatrix.DefaultHelmChartRef {
		t.Errorf("Step 1 Chart = %q, want %q (should not use ChartRef)", step1Flags.Chart, versionmatrix.DefaultHelmChartRef)
	}
	if step1Flags.ChartVersion != "12.5.0" {
		t.Errorf("Step 1 ChartVersion = %q, want %q", step1Flags.ChartVersion, "12.5.0")
	}

	// Step 2 should inherit the ChartRef override from baseFlags.
	step2Flags := *baseFlags
	if step2Flags.Chart != opts.ChartRef {
		t.Errorf("Step 2 Chart = %q, want %q (should inherit ChartRef)", step2Flags.Chart, opts.ChartRef)
	}
	if step2Flags.ChartVersion != opts.ChartRefVersion {
		t.Errorf("Step 2 ChartVersion = %q, want %q", step2Flags.ChartVersion, opts.ChartRefVersion)
	}
}

// --- effectiveImageTags tests ---

func TestEffectiveImageTags(t *testing.T) {
	tests := []struct {
		name           string
		entryImageTags bool
		opts           RunOptions
		want           bool
	}{
		{
			name:           "scenario flag true, no runtime override",
			entryImageTags: true,
			opts:           RunOptions{},
			want:           true,
		},
		{
			name:           "scenario flag true, DisableImageTags overrides to false",
			entryImageTags: true,
			opts:           RunOptions{DisableImageTags: true},
			want:           false,
		},
		{
			name:           "scenario flag false, no override",
			entryImageTags: false,
			opts:           RunOptions{},
			want:           false,
		},
		{
			name:           "scenario flag false, DisableImageTags is a no-op",
			entryImageTags: false,
			opts:           RunOptions{DisableImageTags: true},
			want:           false,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := effectiveImageTags(tt.entryImageTags, tt.opts)
			if got != tt.want {
				t.Errorf("effectiveImageTags(%v, opts) = %v, want %v", tt.entryImageTags, got, tt.want)
			}
		})
	}
}

// --- chartRootOverlays tests ---

func TestChartRootOverlays(t *testing.T) {
	tests := []struct {
		name  string
		entry Entry
		opts  RunOptions
		want  []string
	}{
		{
			name:  "image-tags true (scenario default): no version overlay; env-file handles SNAPSHOT injection",
			entry: Entry{ImageTags: true},
			opts:  RunOptions{},
			want:  nil,
		},
		{
			name:  "DisableImageTags + local chart: falls back to digest",
			entry: Entry{ImageTags: true},
			opts:  RunOptions{DisableImageTags: true},
			want:  []string{"digest"},
		},
		{
			name:  "DisableImageTags + OCI: no overlay at all",
			entry: Entry{ImageTags: true},
			opts:  RunOptions{DisableImageTags: true, ChartRef: "oci://registry.camunda.cloud/team-distribution/camunda-platform"},
			want:  nil,
		},
		{
			name:  "DisableImageTags + UseLatest + local chart: values-latest.yaml",
			entry: Entry{ImageTags: true},
			opts:  RunOptions{DisableImageTags: true, UseLatest: true},
			want:  []string{"latest"},
		},
		{
			name:  "OCI always wins over UseLatest",
			entry: Entry{ImageTags: true},
			opts:  RunOptions{DisableImageTags: true, UseLatest: true, ChartRef: "oci://registry.camunda.cloud/team-distribution/camunda-platform"},
			want:  nil,
		},
		{
			name:  "enterprise composes with digest",
			entry: Entry{Enterprise: true, ImageTags: true},
			opts:  RunOptions{DisableImageTags: true},
			want:  []string{"enterprise", "digest"},
		},
		{
			name:  "enterprise + OCI: enterprise overlay kept, no version overlay",
			entry: Entry{Enterprise: true, ImageTags: true},
			opts:  RunOptions{DisableImageTags: true, ChartRef: "oci://registry.camunda.cloud/team-distribution/camunda-platform"},
			want:  []string{"enterprise"},
		},
		{
			name:  "enterprise composes with latest",
			entry: Entry{Enterprise: true, ImageTags: true},
			opts:  RunOptions{DisableImageTags: true, UseLatest: true},
			want:  []string{"enterprise", "latest"},
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := chartRootOverlays(tt.entry, tt.opts)
			if len(got) != len(tt.want) {
				t.Fatalf("chartRootOverlays() = %v, want %v", got, tt.want)
			}
			for i := range got {
				if got[i] != tt.want[i] {
					t.Errorf("chartRootOverlays()[%d] = %q, want %q", i, got[i], tt.want[i])
				}
			}
		})
	}
}